The security of computer systems is a topic of very serious concern to almost every enterprise in today's society. Broadly speaking, there are two aspects of computer security. One aspect concerns the invasion of unwanted objects, such as viruses, from the outside world into the computer system. Infection of a computer system by a Trojan horse, for example, can disturb or disable the computer system or an application and thereby severely affect productivity. Another aspect of computer security concerns the unwanted escape of information from the computer system to the outside world. The threat of unwanted escape of information takes several forms. In one form, hackers may attempt to gain access to an enterprise's computer system so as to pilfer valuable information. In another form, disloyal employees or other “insiders” may attempt to accomplish the same end by the access that they legitimately have.
External (or removable) storage media devices are particularly vulnerable parts of a computer system. Those with access to external media storage devices on a computer system can potentially write sensitive or valuable information from the computer system to a removable media (e.g., floppy disk, writable CD (compact disc), removable hard disk drive, IOMEGA™ zip drive, etc.) and thereby escape with the information. Present attempts to deal with this type of threat are based on either external storage media device access prevention or external storage media device usage monitoring.
Physical access prevention measures have several disadvantages. For example, preventing users from using floppy disk drives altogether goes too far and significantly impedes the transfer of information, thus severely limiting the usefulness of the computer system. Another technique utilizes external storage media drives having physical locks, which a computer administrator must manually unlock to allow access to the drive. This approach provides some flexibility but at a great inconvenience. A significant advance occurs when software is utilized to control who can access external storage media and when such access can occur. Such a system is employed in the software program “SecureNT”™ available from SecureWave S.A., Luxembourg. SecureNT involves a client program that runs on each individual computer in a network and an administrator application that runs on a system administrator console. Through the administrator application, an administrator can remotely command the client programs on any of the various computers in the network to grant or revoke access to any I/O (input/output) device or interface port, including external storage media devices. SecureNT enables physical access control to be implemented electronically. In this way, access policies can be established and enforced on a simpler, consistent and centralized basis. The result is a more effective access prevention security system.
Existing measures based on monitoring usage of external media storage device are not fully effective. Example of this approach are (1) logging the names of files written to an external storage media; (2) filtering the content of files written to external storage media; and (3) combinations of the above. Ones wishing to do so can easily circumvent these measures. For example, changing the name of a file before copying it to an external storage medium defeats the first approach, and simple keyword replacement can defeat the second approach in which filtering is based on keywords in the content.
In another area of related art, storage shadowing is well known for purposes of data loss prevention. In a typical shadowing (also called “mirroring” or “mirrored”) storage system, all data written to an entire disk is maintained in duplicate, usually on physically separate disks. Because the redundant shadowed or mirrored copy is kept for backup purposes, great steps are taken to ensure that the shadowed or mirrored data is complete and consistent. This type of shadowing is applied to internal or fixed disk drives rather than removable medium storage devices, because there is no pressing need to archive or mirror data written to a removable medium storage device; such data is already a copy of other data on the system.